Privacy Policy

This Privacy Policy describes how Retention Track Pty Ltd (ABN 28 682 975 373) (we, us, our) collects, uses, stores and discloses personal information in connection with the bondtrack platform (the Platform). It applies to information collected through the Platform, our websites, our emails, and any related services. By accessing or using the Platform you consent to the practices described below.

1. Who we are

The Platform is owned and operated by Retention Track Pty Ltd, a company registered in Australia. Our registered office is at Unit 15, 5 Murphy Street, O'Connor, Western Australia 6163. You can contact us about this Policy at privacy@retentiontrack.com.

2. Information we collect

The categories of personal information we collect depend on how you interact with the Platform. They may include:

• Account information: name, work email address, password (hashed), profile image, the organisation and company you belong to, and a record of your acceptance of our Access Terms and this Policy (the date you accepted and the version you were shown).
• Workspace content: information you enter about your business, counterparties, projects, bonds, bank guarantees, facilities (including the names of individuals who have given a personal guarantee or indemnity for a facility), premiums, documents and related correspondence.
• Communications: emails you send to us, support requests, invitations you send to other users, and notification preferences. If you complete the register interest form on our website, the name, email address, company, country and message you enter.
• Technical data: IP address, browser type and version, device identifiers, time-zone setting, operating system, and pages or features accessed.
• Usage and analytics data: on the Platform, with your consent, product analytics and session replay events captured by PostHog to help us understand how the Platform is used. On our website, page views and two actions, as section 9 describes.

We do not knowingly collect special-category personal information (such as health, biometric or political data) and we ask that you do not upload such information to the Platform.

3. How we collect information

• Directly from you when you create an account, complete forms, configure your workspace, or contact us.
• From other users in your organisation when they invite you or record information about counterparties or projects you work on.
• Automatically from your device and browser when you use the Platform, including through cookies and similar technologies (see section 9).
• From our service providers (such as our authentication, hosting, email and analytics providers) acting on our behalf.

4. Why we collect information

We use personal information to provide, secure and improve the Platform, including to:

• create and administer your account, authenticate you, and manage organisation and company memberships;
• deliver the core features of the Platform (tracking surety bonds, bank guarantees, facilities, counterparties and related records);
• send transactional emails such as account confirmations, password resets, invitations, and notifications you have opted into;
• respond to your enquiries and provide customer support;
• monitor performance, diagnose issues, detect and prevent fraud or abuse, and otherwise keep the Platform secure;
• understand how the Platform is used and improve it (on the Platform where you have consented to analytics, and on our website as section 9 describes); and
• comply with our legal, regulatory and contractual obligations.

5. Who we share information with

We share personal information only where necessary to operate the Platform or as permitted by law. Our key sub-processors are:

• Supabase — managed PostgreSQL database and authentication infrastructure.
• Vercel — application hosting and edge delivery.
• Resend — transactional email delivery (account confirmations, password resets, invitations).
• PostHog — product analytics and session replay (only when you have accepted analytics cookies — see section 9).
• Xero — accounting. Where your brokerage has connected its Xero organisation, we send the billing details of your bonds (company name and address, contact details, invoice figures and references) to Xero so that invoices, bills and credit notes can be drafted for review. This only applies to accounts that use the brokerage billing features.
• TrackingMore — parcel tracking. When an original bond is returned to an issuer by courier, we send its tracking number and courier to TrackingMore so we can tell when the courier records it as delivered. We do not send names, addresses or any other details of the bond, and we do not keep the name of whoever signed for the parcel.

We may also disclose personal information to our professional advisers, to related entities, in connection with a corporate transaction (such as a sale of the business), or to law enforcement or other authorities where required by law.

Applications you connect yourself. You can connect a third-party application — for example an AI assistant — to work with bondtrack on your behalf. A connected application acts as you: it can see only what your own account can already see, and it can create records only where your own roles already permit it to. It cannot authorise a bond application, submit one to an issuer, or send anything to your accounting system. We do not choose, control or vet the applications you connect: once information reaches one, its own privacy terms apply rather than this policy. You can disconnect an application at any time, and it stops being able to reach your account immediately.

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes.

6. Overseas disclosure

Several of our sub-processors are based outside Australia. In particular, Vercel, Resend and PostHog process data in the United States and the European Union, Xero processes data in New Zealand and the United States, and TrackingMore (operated by Channelwill Co., Limited) processes data in Hong Kong, China and the United States. Where we transfer personal information overseas, we take reasonable steps to ensure that the recipient handles your information in accordance with applicable privacy laws, including (where relevant) by relying on Standard Contractual Clauses or equivalent safeguards.

7. Your rights and choices

Depending on your location, you may have the following rights in respect of the personal information we hold about you:

• access a copy of your personal information;
• request that we correct inaccurate or incomplete information;
• request that we delete your personal information (subject to legal or contractual retention requirements);
• object to or restrict certain types of processing, including analytics;
• request a portable copy of personal information you have provided to us; and
• withdraw any consent you have given (for example by changing your cookie preferences in the user menu).

How to make a data access or deletion request

To exercise any of these rights, email us at privacy@retentiontrack.com with the subject line “Privacy request” and a description of what you would like us to do. We may need to verify your identity before we can act on your request. We aim to respond within 30 days. Requests are currently handled manually; we will let you know if we need additional information or time.

If your account belongs to an organisation, please note that your organisation administrator may also be able to action access, correction or deletion requests directly within the Platform.

8. How long we keep your information

We retain personal information for as long as your account remains active and for a reasonable period afterwards to meet our legal, accounting and reporting obligations, resolve disputes, and enforce our agreements. When personal information is no longer required, we take reasonable steps to delete or de-identify it. Workspace content you create is retained for as long as your organisation maintains an active subscription; once your organisation deletes the workspace, we will delete or de-identify the associated data within a reasonable period.

9. Cookies and analytics

We use a small number of cookies and similar technologies:

• Strictly necessary cookies that keep you signed in and remember your theme preference. These are always set and cannot be disabled.
• Analytics and session replay cookies set by PostHog. These are only set if you click “Accept all” on our cookie consent banner. You can change your choice at any time using the “Cookie Preferences” item in the user menu.

When session replay is enabled, all text and form inputs are masked by default. We do not record what you type into the Platform.

Our website

Our website at bondtrack.app uses PostHog to measure page views, a click on its main button, and a register interest submission together with the country chosen on the form. It does not record anything you type into the form. There is no session replay and no autocapture on the website.

We show a cookie banner to visitors in the United Kingdom, the Channel Islands, the Isle of Man, Gibraltar and the European Economic Area, and wherever we cannot tell where a visitor is. Nothing is measured there unless the visitor accepts. Elsewhere we do not show the banner and set analytics cookies on the basis of this notice. If your browser sends a Global Privacy Control signal we treat it as a refusal, and nothing is measured unless you accept from the banner or from Cookie preferences. “Cookie preferences” in the website's footer changes your choice at any time.

Your choice on the website is separate from your choice on the Platform, which asks for its own.

10. Storage and security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration and disclosure. These include encryption in transit and at rest, access controls, audit logging, and contractual obligations on our sub-processors. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

11. Children

The Platform is intended for business use and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

12. Additional information for EU and UK residents

If you are located in the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR) and UK GDPR apply to our processing of your personal information. We act as a “controller” in respect of account information and analytics data, and as a “processor” in respect of workspace content you enter on behalf of your organisation. We rely on the following legal bases: performance of our contract with you, our legitimate interests in operating and improving the Platform, compliance with legal obligations, and (for analytics) your consent. On our website, where we do not show the cookie banner, we measure visits on the basis of the notice in section 9, and only where the law does not require your consent first.

You have the right to lodge a complaint with your local supervisory authority. In the UK this is the Information Commissioner's Office (ICO); in the EU it is the data protection authority of the member state in which you live or work.

13. Additional information for California residents

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with rights to know what personal information we collect about you, to request deletion, to correct inaccurate information, and to not be discriminated against for exercising these rights. The categories of information we collect are described in section 2. We do not sell personal information.

14. Links to other websites

The Platform may contain links to third-party websites that we do not operate. We are not responsible for the privacy practices of those websites and recommend that you review their privacy policies before providing them with personal information.

15. Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. If the changes are material, we will provide more prominent notice (for example, by email or via a notice in the Platform).

16. Complaints

If you have a complaint about how we have handled your personal information, please email us at privacy@retentiontrack.com. We will investigate and respond as soon as reasonably practicable. If you are not satisfied with our response, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au (opens in new tab), or to the data protection authority in your jurisdiction.

17. Contact us

For any questions about this Privacy Policy or how we handle your personal information, please contact us at: